Transparency
What we can and can't read in each app, what's encrypted and how, and what we'll report when someone asks us for your data. If it's on this page, it's checked against the code we run.
The short version
What we can't read
- Your mail: subjects, bodies, attachments and the names in them
- Documents, their titles and every edit
- Spreadsheets: titles, cells, formulas, tab names, formatting, charts and how many rows there are
- Spreadsheet files you import or export (.xlsx, .csv): they're read and written on your device
- Files and file names, and their previews
- Events: titles, times, places, notes and who's coming
- Tasks: titles, notes, due dates, repeats, priorities, labels, who's assigned and how many there are
- Contacts: names, emails, phone numbers, addresses, notes, photos, which card is linked to which Jelly account and how many there are
- Address book files you import or export: they never leave your device
- Chat: messages, channel names and topics, reactions, mentions, file names and what you search for
- Calls: sound, video, shared screens, in-call chat, reactions, raised hands and meeting titles
- Folder names, labels and your settings
- Your team's name and the names of its groups
- Your password and your keys
An example
What you see
Anna and Bob are in the group Leads of the team Acme, and the page Q3 pipeline is shared with Leads.
What our servers see
@anna and @bob are in group 7f3a… of team c91e…, and item b20d… is shared with that group. Not what the team, the group or the page are called, and not what the page says.
We'd rather tell you what's visible than pretend nothing is. The tables below go through every app, row by row: what's sealed, and what a server needs to see to store your things and route your mail.
Your data at a glance
Every piece of data in jellysuite falls into one of five groups. Most of it is in the first two.
- Never sent to us
- Stays on your device, or only travels in a part of a link browsers don't send.
- End-to-end encrypted
- Locked on a device before it reaches us. We store it and can't open it.
- Sealed on arrival
- Mail with outside addresses that isn't PGP: read once in server memory, then locked for you. Never written to disk unlocked.
- Encrypted with our key
- Locked, but with a key our servers hold, because they have to act on it without you.
- Visible to us
- What a server needs in the clear to store your things, deliver mail and sync between people.
Your account
| Password | Never sent to us |
|---|---|
| Recovery key | Never sent to us |
| Account key and every item's key | End-to-end encrypted |
| Settings | End-to-end encrypted |
| Handle and sign-up date | Visible to us |
| Storage used | Visible to us |
| Signed-in sessions: browser name and when last used | Visible to us |
Drive
About Drive →| File and folder names | End-to-end encrypted |
|---|---|
| Contents, file type and thumbnails | End-to-end encrypted |
| Key in a share link | Never sent to us |
| How folders nest | Visible to us |
| Roughly how big each file is | Visible to us |
| When files were added and changed | Visible to us |
| Who it's shared with | Visible to us |
| Data | Between jellysuite accounts | With outside addresses |
|---|---|---|
| Subject, message and attachments | End-to-end encrypted | Sealed on arrival |
| Names in the message | End-to-end encrypted | Sealed on arrival |
| Subject, message and attachments of PGP mail | End-to-end encrypted | End-to-end encrypted |
| Label names | End-to-end encrypted | End-to-end encrypted |
| Mail scheduled with send later | End-to-end encrypted | Encrypted with our key |
| Email addresses on the message | Visible to us | Visible to us |
| Folder, read and starred | Visible to us | Visible to us |
| Size and time | Visible to us | Visible to us |
| Your domain's DKIM signing key | Encrypted with our key | Encrypted with our key |
Pages
About Pages →| Title, content and images | End-to-end encrypted |
|---|---|
| Every edit and the version history | End-to-end encrypted |
| Live cursors and who's typing | End-to-end encrypted |
| Key in a public link | Never sent to us |
| Where a page sits in the tree | Visible to us |
| Who it's shared with | Visible to us |
| When it changed, and the size of each change | Visible to us |
Sheets
About Sheets →| Title, cells and formulas | End-to-end encrypted |
|---|---|
| Tab names, colours and order | End-to-end encrypted |
| Number formats, styles and conditional formats | End-to-end encrypted |
| Charts | End-to-end encrypted |
| How many rows, columns and filled cells there are | End-to-end encrypted |
| Every edit and the version history | End-to-end encrypted |
| Live selections, and who's in which cell | End-to-end encrypted |
| Files you import or export (.xlsx, .csv) | Never sent to us |
| Your filters | Never sent to us |
| Your search terms and the search index | Never sent to us |
| Key in a share link | Never sent to us |
| That a spreadsheet exists, and where it sits in the tree | Visible to us |
| Who it's shared with | Visible to us |
| How big its encrypted document is, and when it changes | Visible to us |
| Who has it open right now | Visible to us |
Calendar
About Calendar →| Title, place and notes | End-to-end encrypted |
|---|---|
| Date, time and how it repeats | End-to-end encrypted |
| Guests' answers | End-to-end encrypted |
| Calendar names | End-to-end encrypted |
| Which calendar an event is in | Visible to us |
| Who's invited, and that they answered | Visible to us |
| When an event changed | Visible to us |
Tasks
About Tasks →| Task titles, notes and subtasks | End-to-end encrypted |
|---|---|
| Due dates, times and how a task repeats | End-to-end encrypted |
| Priorities, labels and who's assigned | End-to-end encrypted |
| Project and section names | End-to-end encrypted |
| How many tasks a project has, and which are done | End-to-end encrypted |
| Your label colours and order | End-to-end encrypted |
| Your search terms and the search index | Never sent to us |
| That a project exists | Visible to us |
| Who a project is shared with | Visible to us |
| How big a project's encrypted document is, and when it changes | Visible to us |
| Who has a project open right now | Visible to us |
Contacts
About Contacts →| Names, organisations and job titles | End-to-end encrypted |
|---|---|
| Emails, phone numbers, addresses and websites | End-to-end encrypted |
| Birthdays, notes and photos | End-to-end encrypted |
| Which card is linked to which Jelly account | End-to-end encrypted |
| Address book names and colours | End-to-end encrypted |
| How many contacts a book has | End-to-end encrypted |
| Addresses you told Mail not to suggest | End-to-end encrypted |
| Files you import or export (.vcf) | Never sent to us |
| Mail's suggestions of who to add | Never sent to us |
| Your search terms and the search index | Never sent to us |
| That an address book exists | Visible to us |
| Who a team address book is shared with | Visible to us |
| How big a book's encrypted document is, and when it changes | Visible to us |
| Who has a book open right now | Visible to us |
| Which address or @handle you check when linking a contact | Visible to us |
| Which linked Jelly accounts your device reads when a card opens or @ suggests people | Visible to us |
Chat
About Chat →| Messages, edits and replies | End-to-end encrypted |
|---|---|
| Channel names, topics and descriptions | End-to-end encrypted |
| Reactions and the emoji used | End-to-end encrypted |
| Mentions | End-to-end encrypted |
| File names, contents and previews | End-to-end encrypted |
| Who is typing | End-to-end encrypted |
| Your search terms and the search index | Never sent to us |
| Who is in each channel and conversation | Visible to us |
| Who posted each entry, including reactions and pins, when, and roughly how big it is | Visible to us |
| When a message was edited or deleted | Visible to us |
| Whether a thread reply was also shown in the channel | Visible to us |
| Whether an entry is a message, reply, reaction or pin, and which message it points to | Visible to us |
| Each person's read position, and their mute and notification settings | Visible to us |
Video
About Video →| Sound, video and shared screens | End-to-end encrypted |
|---|---|
| In-call chat, reactions and raised hands | End-to-end encrypted |
| Meeting titles | End-to-end encrypted |
| The key of each call, sealed with the key of its channel, event or meeting room | End-to-end encrypted |
| Huddle notes kept in the channel's thread | End-to-end encrypted |
| Which chat entry is a huddle's record, and which thread holds its notes | Visible to us |
| Recordings and transcripts: there are none | Never sent to us |
| Which channel, meeting room or event has a call going on | Visible to us |
| Who joins and leaves, when, and from how many devices | Visible to us |
| How long a call lasts | Visible to us |
| Whose microphone, camera or screen share is on, and how much data each sends | Visible to us |
| Who is speaking, worked out from how loud each sound stream is | Visible to us |
| When a host mutes or removes someone, locks the call or ends it | Visible to us |
| The IP address you connect to the media server from | Visible to us |
Teams
| Team name and group names | End-to-end encrypted |
|---|---|
| Team and group keys | End-to-end encrypted |
| Key in an account activation link | Never sent to us |
| Which teams exist, and who's in each | Visible to us |
| Each member's role, and whether they're active, suspended or removed | Visible to us |
| Which groups exist, and who's in each | Visible to us |
| Which items are shared with which groups | Visible to us |
| Which items are restricted | Visible to us |
| When invitations were made, accepted and expire | Visible to us |
Billing
| Card number and payment details: entered on Stripe's checkout page | Never sent to us |
|---|---|
| Name, billing address, email and VAT ID on your invoices: held by Stripe | Never sent to us |
| Your plan, whether you pay monthly or yearly, and how many seats | Visible to us |
| Whether the subscription is paid, and when it renews or ends | Visible to us |
| Which Stripe customer pays for which account or team | Visible to us |
Billing
Paying for a plan means giving a name, a billing address and, for businesses, a VAT ID. Stripe, our payment provider, holds those along with your card; we keep only Stripe's reference numbers, your plan and its status. This does link a real identity to your handle. It changes nothing about your content, which stays encrypted with keys we never have.
Not stored at all
Your IP address is used in memory to slow down password guessing, and that's it: it isn't written to a log or a database. The one exception is a call, where the media server needs your address to send you sound and video (see Video above). Calls aren't recorded, and no sound or video is ever stored. We don't use analytics or tracking scripts in the apps.
The limits of a call's encryption
- A call's key is sealed with the key of the channel, event or meeting room the call belongs to. Everyone with access to that could open it; who is let into the call and handed its key is enforced by our servers.
- After a host removes someone, our servers stop handing them keys and the call moves to a new key. Their media server pass lasts up to 6 hours and can't be withdrawn: their device can reconnect for a few seconds and is dropped again each time, seeing only encrypted data.
- When someone loses access to the channel, event or meeting room during a call, a call key may be made under a key they still hold until an editor re-keys it. It is only handed to people in the call, and the call moves to a new key once that is done.
- A person in a call working together with our media server could pass off their own sound or picture as another participant's. Our servers alone can't, and nobody outside the call can.
Requests for your data
No reports yet
Updated 8 October 2026We haven't received a request so far. Every legal request we do receive goes here: how many, from which country, and what we handed over. Whatever the request, the most we can hand over is what's marked Visible to us above. We don't have the keys to the rest.
Security audits
No independent audit yet
Our code has been through our own security reviews, not yet an outside firm's. When an independent audit is done, the full report and our responses go here. Until then, the code that handles your keys is open for anyone to read.